One agency can never see another's data
Isolation is enforced twice, independently, so one mechanism failing does not become a breach.
Every table holding customer data has Postgres row-level security enabled and forced, so even the table's owner is bound by it.
On top of that, every query the product runs names your agency explicitly. Two layers, so isolation never rests on one control — or on someone remembering a WHERE clause.
ALTER TABLE maintenance_issues FORCE ROW LEVEL SECURITY;
Hosted in the EU — with the exceptions stated
| Data at rest in Frankfurt | The database — tenancies, reports, compliance records, jobs — is hosted in the EU, in Frankfurt. |
| UAE and Singapore: transfers by contract | For agencies in the UAE (PDPL) and Singapore (PDPA), storing data in Frankfurt is a cross-border transfer. It is covered in the data processing agreement, with the safeguards those laws expect. |
| Paging texts: United States by default | Out-of-hours texts and calls go through Twilio, which processes message content in its US region by default. A page contains the tenant's address and their words, so the region in use is shown on the settings screen. An EU (Ireland) region can be configured instead. |
| Email through Resend | Landlord approvals and alerts are sent by email through Resend. |
| What we don't store | No NRIC or FIN numbers, and no immigration status. For Singapore pass checks, only the date of the check and the pass expiry are recorded. |
Rules you can read back to a dispute centre
No AI model in the decision
Repair triage runs on written rules, on our own infrastructure. No third-party AI model reads the tenant's report to decide its priority.
Wrong in one direction only
Ambiguity rounds up. A report in a language it doesn't read is rounded up and flagged for a person. Nothing lowers a priority once a rule has raised it.
Tested in every language
132+ automated tests cover the rules in English, Arabic, German and Chinese, so a change that stops recognising "رائحة غاز" fails the build instead of failing a household.
Everything on the record. Every link does one thing.
The tenant's words, verbatim
A report is kept exactly as written, with the rule that fired, every page sent, who acknowledged and when, and every landlord decision — in the agency's working language.
Tokens as links, scoped to one row
Nobody woken at 4am should need a password. The acknowledge, approval and landlord-page links carry an unguessable token, and the database lets each token reach only the one record it was issued for.
Decisions recorded once
A landlord's approve or decline is recorded once, with the amount as it was when asked. It can't be quietly overwritten.
Concierge Legend is not an emergency service: it gives tenants the right local numbers and wakes your own staff, but responding to an emergency remains with the agency and the landlord. Independent security testing and formal certification are not yet in place; we will say exactly what we hold, and when.